CVE-2026-2907

CVE-2026-2907 is a high-severity stack-based buffer overflow vulnerability affecting Tenda HG9 300001138 firmware. Specifically, it impacts the GPON Configuration Endpoint via manipulation of the fmgpon_loid/fmgpon_loid_password arguments in the /boaform/formgponConf file. This flaw allows for remote exploitation, potentially leading to complete compromise of the affected device. The vulnerability has a CVSS score of 8.8 (High), indicating a critical risk due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While the exploit has been made public, there is no evidence of active exploitation in the wild, nor is it listed on the CISA KEV catalog. Despite the public exploit, there is minimal community discussion or media coverage surrounding this CVE. No Metasploit, Nuclei, or ExploitDB modules are currently available. Organizations using affected Tenda HG9 devices should prioritize patching to mitigate this significant security risk.